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Preface 



The Department of Homeland Security, Office of Inspector General, was established by 
the Homeland Security Act of 2002 (Public Law 1 07-296) by amendment to the Inspector 
General Act of 1978. This is one of a series of audit, inspection, and special reports 
prepared as part of our oversight responsibilities to promote economy, efficiency, and 
effectiveness within the department. 

This report addresses the effectiveness of the Transportation Security Administration's 
Known Shipper Program. It is based on interviews with employees and officials of the 
Transportation Security Administration, direct observation, and a review of applicable 
documents. 

The recommendations herein have been developed to the best knowledge available to our 
office and have been discussed in draft with those responsible for implementation. We 
trust this report will result in more effective, efficient, and economical operations. We 
express our appreciation to all of those who contributed to the preparation of this report. 




Richard L. Skinner 
Inspector General 
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Abbreviations 

DHS Department of Homeland Security 

KSDB Known Shipper Database 

KSMS Known Shipper Management System 

KSP Known Shipper Program 

TSA Transportation Security Administration 



OIG 



Department of Homeland Security 
Office of Inspector General 

Executive Summary 

The Transportation Security Administration is responsible for 
overseeing aviation security and ensuring the safety of the air 
traveling public. This includes the screening of all passengers and 
their personal property, as well as approximately 13,000 tons of 
cargo transported on passenger planes each day. The agency 
requires each regulated entity, such as an air carrier or freight 
forwarder, to ensure a shipper is known before accepting its cargo 
for transport on passenger aircraft. 

The Transportation Security Administration is developing the 
Known Shipper Management System, which is an automated 
process for verifying the validity and integrity of shippers. The 
agency plans to make this the primary method for making shippers 
known; however, it must resolve challenges in the development 
and deployment of the system, including technical problems and 
policy issues. The other two methods available to verify a known 
shipper are manual procedures and the Known Shipper Database. 
These methods do not provide assurances that only known shipper 
cargo is transported on passenger aircraft. The agency's criteria 
and guidance for evaluating a shipper are unclear and subject to 
interpretation, increasing the risk that shippers may be improperly 
classified as known. The Transportation Security Administration's 
inspection and testing activities do not provide assurances that 
regulated entities are complying with the program's vetting 
requirements. 

We are making six recommendations to the Assistant Secretary of 
the Transportation Security Administration to strengthen the 
controls and oversight of the Known Shipper Program. The 
agency generally concurred with our recommendations. 
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Background 



The Aviation and Transportation Security Act of 2001 requires the 
screening of all passengers and property transported on passenger 
planes. The Act gives the Transportation Security Administration 
(TSA) responsibility for overseeing aviation security and ensuring 
the safety of the air-traveling public. TSA continues to improve air 
cargo security using a risk-based, layered approach to enhance 
security without impeding the flow of commerce. 

The Federal Aviation Administration created the Known Shipper 
Program (KSP) before the September 2001 terrorist attacks and the 
creation of the Department of Homeland Security. The KSP is one 
of TSA's key components for strengthening air cargo security. 
The program establishes procedures for differentiating between 
shippers that are known and unknown for air carriers and indirect 
air carriers who tender cargo for air transportation. Title 49 of the 
Code of Federal Regulation provides that, with limited exceptions, 
domestic and foreign passenger aircraft operators, all-cargo aircraft 
carriers, or indirect air carriers, also known as freight forwarders, 
operating under an approved TSA Standard Security Program may 
tender cargo for transport on passenger aircraft only from shippers 
that are verified as known. 

A known shipper is a person that has an established business 
relationship with an indirect air carrier, an aircraft operator or an 
air carrier based on items such as customer records, shipping 
contracts, a business history and a site visit, or Dun and Bradstreet 
vetting. Currently, TSA allows regulated entities to use several 
methods to classify a shipper as known: 

• Manual procedures, 

• Known Shipper Database (KSDB), and 

• Known Shipper Management System (KSMS). 
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Before TSA assumed responsibility from the Federal Aviation 
Administration, manual procedures were the original method for 
identifying known 
shippers. Prior to 
accepting cargo for 
transport on passenger 
aircraft, industry 
partners are 
responsible for 
conducting shipper 
vetting. For a shipper 
to be considered 
known, a regulated 
entity must ensure the 
existence, 
performance, and 
documentation of a 
customer record, along 
with either an established shipping contract or an established 
business history. The regulated entity must also conduct and 
document a site visit. 

The Federal Aviation Administration enhanced its manual 
procedures by developing the KSDB. The KSDB was an 
electronic repository of manually vetted shippers, which 
streamlined the process for regulated entities to verify the status of 
known shippers. Even when a participating regulated entity did 
not originally conduct the vetting, that entity was allowed to rely 
on the known shippers of other entities within the KSDB. TSA 




TSA introduced KSMS for regulated entities' use in January 2007. 
Under KSMS, TSA conducts the vetting of domestic shippers and 
determines which shippers qualify for known status. Although the 
system is still under development, TSA is now operating KSMS 
and plans to mandate regulated entities' use of the system as the 
primary method for establishing and verifying known shippers. 



Customer records must contain a shipper's 
name, physical address, phone number, and 
established and verifiable business payment or 
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TSA requires regulated entities to submit shipper data to KSMS. 
That data undergoes a systematic risk assessment to determine 
whether a shipper can be considered 
known. To evaluate a shipper's 
validity and integrity, KSMS 
electronically compares seven 
elements submitted by a regulated 
entity to existing business 
intelligence compiled by Dun & 
Bradstreet. KSMS applies a 
weighted scoring methodology by 
assessing the level of consistency 
between each corresponding 
element in the respective data sets. 
KSMS also checks shippers against 
a list maintained by the Department 
of Treasury's Office of Foreign Assets Control, which administers 
and enforces economic sanctions programs, primarily against 
countries and groups of individuals such as terrorists and narcotics 
traffickers. An overview of all three methods for establishing and 
verifying a known shipper can be found in Appendix C. 

TSA conducts inspections to ensure that regulated entities comply 
with known shipper requirements. TSA employs approximately 
300 cargo transportation security inspectors dedicated exclusively 
to the oversight of air cargo security. TSA inspectors typically 
conduct inspections at air carriers, indirect air carriers, and all- 
cargo operator stations. TSA also conducts monthly special 
emphasis assessment tests at high-volume cargo airports, in which 
TSA inspectors pose as unknown shippers and attempt to ship 
cargo on passenger aircraft. 



To support electronic vetting 
through KSMS for each 
potential known shipper, 
regulated entities are required to 
submit: 

• Business name 

• Street number 

• Street name 

• City 

• State 

• Post office box number 

• Telephone number 
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Results of Audit 



TSA's KSP does not provide assurance that only cargo from 
known shippers is transported on passenger aircraft. TSA has 
made progress in improving the KSP by developing KSMS; 
however, the agency has not resolved technical problems and 
policy issues, which has hindered its use as the primary method for 
establishing and verifying known shippers. 

The agency's criteria and guidance for the other two methods used 
to make shippers known, manual procedures and the KSDB, are 
unclear and subject to interpretation. This increases the risk that 
shippers may be improperly vetted and, therefore, unknown. 
TSA's oversight activities do not ensure that regulated entities are 
complying with KSP requirements. 

Until KSMS issues are resolved, regulated entities may use any of 
the three KSP methods for transporting cargo on passenger aircraft. 
Vulnerabilities within each method increase the potential for 
someone to falsify or counterfeit shipping documents to become a 
known shipper, thereby increasing the risk to passenger aircraft 
security. 

KSP Improvement Efforts Face Continued Challenges 

TSA has made progress in modifying the KSP with the 
introduction of the KSMS vetting process, but the agency has been 
unable to fully implement the new method. TSA has not resolved 
ongoing technical problems and policy issues in developing and 
implementing KSMS, which has hindered the agency from making 
KSMS the primary method for establishing and verifying known 
shippers. Until these issues are resolved, regulated entities may 
use any of the three available KSP methods, which pose 
vulnerabilities to air cargo security. 

KSMS Technical Problems 

Unanticipated technical problems and performance-related issues 
arose during every phase of KSMS development and deployment. 
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After TSA launched KSMS, regulated entities experienced 
problems using the system. For example: 

• Some regulated entities were unable to access KSMS to 
upload shipper lists for vetting; 

• KSMS was returning vetted and appended shipper lists to 
the wrong party; 

• KSMS was returning inaccurate shipper status 
determinations to some users; and 

• KSMS required a lengthy amount of time to conduct start- 
to-finish processing of shippers, significantly delaying 
regulated entities' receipt of status determinations. 

TSA officials and the KSMS development contractor explained 
that technical problems existed between the intended functional 
requirements and TSA's existing operating platform. The 
contractor was responsible for determining the functional 
requirements and designing a system that would work within the 
context of both existing and potential technologies. TSA directed 
the contractor to customize the database engine within the 
agency's existing technologies to support KSMS functionality. 
According to the contractor, TSA's existing technology, an Oracle 
database, was not designed to handle the high volume of KSMS 
data. 

TSA's KSMS has exceeded cost expectations and is behind 
schedule because of these ongoing technical problems. In the 
majority of their weekly project status reports, the KSMS 
integrated project team said the overall project status was less than 
acceptable because of the system's technical problems and the 
project's inability to stay on schedule. TSA could not provide 
documentation to show the estimated initial costs for developing 
and deploying KSMS due to insufficient strategic planning for the 
system. We have therefore been unable to determine the extent of 
the delay and the associated cost overrun. However, as of July 
2008, TSA had spent more than $34 million and taken more than 3 
years to implement KSMS. 

The KSMS project incurred delays in January 2007 because TSA 
could not immediately extend the contract with Dun & Bradstreet 
for business intelligence to support the shipper vetting process. 
The KSMS project manager was informed just 48 hours before the 
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expiration of the contract that TSA could not exercise the option 
year based on a new Department of Homeland Security (DHS) 
contracting requirement. All KSMS testing and production work 
stopped for nearly 3 months until the contracting issue was 
resolved. 

TSA officials acknowledged that the agency could have prevented 
or alleviated some of the technical problems through better 
management and oversight of the KSMS project and the system's 
developer. TSA also indicated that KSMS performance suffered 
from the contractor's lack of expertise in building systems 
designed to perform KSMS functions, as well as insufficient 
contractor personnel to support the project. 

KSMS Policy Issues 

TSA has not resolved several KSMS policy issues. Under KSMS, 
a known shipper is identified by the name and physical address of 
the facility where the cargo is physically tendered from, not by a 
third-party "bill-to" address. However: 

• TSA has not decided how entities can tender cargo from a 
location other than the shipper's physical address, such as a 
trade show. 

• TSA has not decided how domestic known shippers with 
foreign business locations can tender cargo abroad for 
transport on passenger aircraft. 

TSA is currently working to resolve these policy issues, but the 
agency could not estimate when they would be finished. TSA's 
procedures allow regulated entities to comment on the proposed 
changes, which the agency must consider before finalizing the 
policy. As a policy is changed, TSA must issue amended standard 
security programs for each type of entity subject to KSP 
requirements before declaring KSMS compliance mandatory, 
which may cause further delays. 

Due to the ongoing technical problems and unresolved policy 
issues, TSA has postponed mandating the use of KSMS on several 
occasions. Table 1 shows TSA's repeated efforts to communicate 
dates for mandating KSMS as the only method for regulated 
entities to establish and verify known shippers. 
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Table 1: KSMS Delay Timetable 



Date 


TSA Message Regarding KSMS Implementation 


January 20, 2007 


After 90 calendar days, KSDB will be deactivated, making KSMS 
the only permissible tool for electronically verifying shippers. 


March 26, 2007 


Due to unforeseen system problems, TSA cannot provide a specific 
date when KSMS will be fully operational. In the interim, regulated 
entities may continue using the alternative procedures. 


August 23, 2007 


KSDB will be deactivated on October 31, 2007, making KSMS the 
only permissible tool for electronically verifying shippers. 


October 12, 2007 


TSA withdraws mandatory KSMS compliance as of October 31, 
2007. After this date, regulated entities may use KSMS, manual 
procedures, or KSDB printouts to verify known shippers until April 
30, 2008, or until the amended standard security programs are 
issued. 


March 14, 2008 


TSA withdraws the April 30, 2008, date and permits regulated 
entities to continue using any of the three methods to verify known 
shippers until further notice. 



Until TSA mandates KSMS, regulated entities may verify known 
shipper status through any of the three available methods. Entities 
may exploit some vulnerabilities in these three systems to obtain 
the most favorable outcomes for their purposes. For example, 
KSMS may determine that a shipper matched to the Office of 
Foreign Asset Control list presents a security risk and therefore is 




KSP Manual Procedures and KSDB Do Not Ensure 
Passenger Aircraft Cargo Security 

Manual procedures and KSDB do not provide assurances that the 
KSP has strengthened cargo security on passenger aircraft. TSA 
has not provided clear criteria and specific guidance for making a 
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shipper known. As a result, regulated entities may be improperly 
classifying shippers as known and allowing cargo from unknown 
shippers to be transported on passenger aircraft, posing potential 
risks to air cargo security. 

TSA's written standard security programs do not provide enough 
guidance on the level of details that need to be collected and 
reviewed in making a shipper known through the manual 
procedures and KSDB. Under these methods, entities are allowed 
to perform minimal investigative procedures to demonstrate that 
these shippers are trustworthy and have adequate security measures 
in place to ensure the integrity of their shipments. 

For example, the agency's standard security programs require 
entities usin g the manual procedures to ensure the existence of a 

The established 

shipping contract must cover a series of shipments. However, the 
security 



TSA's standard security programs also do not sufficiently define 
how to establish a business history to consider a shipper known. 
The programs explain that an established business history consists 
of: 



TSA does not specify how[ 
support a business histon 




must be achieved to 
It implies the entity must transport the 
shipments through other modes of 
transportation since cargo cannot be transported on passenger 
aircraft until a business history is established. However, this is not 
clear. Fo r example, one air carrier assumed it c ould transport a 

on its own aircraft, 



shipper's 
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but a TSA inspector cited the air carrier for improperly declaring 
the shipper as known. 

KSP site visit verifications to substantiate a known shipper's 
existence are not always properly conducted. Manual procedures 
require regulated entities to complete a verification form while 
performing a site visit to a shipper's location to classify it as 
known, but TSA does not provide any instructions or guidance for 
collecting the information. With the exception of a shipper 
representative's signature, anyone could complete all required 
fields on the form without having actually visited the shipper's 
location to confirm its existence. 

Inspection reports addressing site visit forms noted violations or 
confusion about the requirement to conduct site visits in 
conjunction with completing the form. For example: 

• One airport reported that two entities allowed shippers to 
complete and fax back site verification forms rather than 
conducting on-site visits. 

• At a second airport, the indirect air carrier's owner told the 
inspector that since he knew an individual working at the 
shipper's business, he considered it known and did not 
complete the required form. 

Additionally, 14 of the TSA inspectors we interviewed said 
regulated entities often had concerns that the requirements for 
maintaining manual records were unclear and confusing. 

Similar to the manual procedures, KSDB does not provide 
adequate assurances that a shipper is known before transporting 
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to verify known shippers, but the agency could not quantify the 
current level of KSDB usage. 

By not providing specific criteria and guidance to establish and 
verify a known shipper, TSA provides opportunities for any 
shipper, including criminals or terrorists, to obtain known status 
without adequate verification. This shortcoming increases the 
opportunity for someone to falsify or counterfeit shipping 
documents and become a known shipper, posing vulnerabilities 
and possible risks to passenger aircraft security. 

TSA's Inspection and Testing Activities Do Not Ensure KSP 
Compliance 

TSA's inspection and testing activities do not provide assurances 
that regulated entities are complying with KSP requirements. TSA 
does not provide specific guidance on the inspection process, 
which allows varying interpretations and may lead to inaccurate 
results. TSA inspectors perform covert special emphasis 
assessment testing of regulated entities to assess compliance, but 
these tests are not always effective and realistic. As a result, the 
agency may be missing opportunities to identify areas of the KSP 
that could be improved to decrease vulnerabilities and strengthen 
air cargo security. 

KSP Inspections 

TSA's inspections may not accurately determine KSP compliance. 
Inspectors conduct these activities based on their own 
interpretation of the inspection guidance. The agency's national 
inspection manual provides limited information about the four 
general inspection methods that inspectors may use: surveillance, 
interviewing, reviewing documentation, and testing. The 
inspection manual does not specify to what extent each inspection 
method should be applied. Given such flexibilities, inspectors may 
favor one inspection method over the other three, which may not 
effectively identify KSP violations. 
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Some inspectors do not review enough documentation to determine 
KSP compliance. Inspectors use their own discretion on the types 
and amounts of documents to review. We reviewed the results of 
TSA's inspections in which inspectors determined whether 
regulated entities vetted known shippers according to the manual 
procedures. Of the 248 questions or prompts we reviewed, 
inspectors concluded that entities were in complia nce in 112 
instances. As s hown in Table 2, insp ectors did notP 
Il ^ ^ jll B iSli instances and verified Q 
mHothers, providing little evidence to support compliance. 





Additionally, 
inspectors frequently 
relied on interviews as 
primary support for 
whether regulated 
entities met KSP 
requirements. Relying 
on interviews may not 
give the inspectors 
enough information to 
identify instances of 
noncompliance. 

As shown in Exhibit 1 , 
a few exemptions allow 
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the transport of cargo from unknown shippers on passenger 
aircraft. We reviewed 1 82 inspection reports in which inspectors 
addressed whether indirect air carriers transported unknown 
shipper cargo and noted 98 instances that were "Not Applicable." 
These reports indicated: 

• Inspectors relied primarily on interviews for 80 of the 98 
instances, or 82 %. There was no additional support 
showing that inspectors checked documentation or 
observed the entities accepting cargo. 

• On four inspection reports, the inspector specifically 
reported conclusions based on both interviews and 
document reviews. 

• For the remaining 14 instances, we were unable to 
determine how the inspectors supported the conclusion that 
this question did not apply to the indirect air carrier. 

Inspectors' frequent reliance on just one inspection method, such 
as an interview, to determine applicability may not identify 
instances of KSP violations. TSA's oversight of the KSP would be 
stronger when inspectors use more than one of the four general 
inspection methods prescribed in the inspection manual, and when 
they examine more documentation during their inspections. 

TSA's Special Emphasis Assessment 
and Covert Testing of KSP Compliance 

TSA's special emphasis assessment tests to determine compliance 
with KSP requirements are not always realistic, adequate, or 
reliable. According to the testing protocols, the objective of the 
tests is "to determine, through realistic testing," whether regulated 
entities are properly identifying and subsequently refusing to 
transport unknown shipper cargo on passenger aircraft. However, 
TSA's assessment testing protocols do not always consider the 
unique nature of the various airports' operations. 

For example, a supervisory inspector reported that most of the 
indirect air carriers at his airport have only one or two customers. 
However, this official is required to perform 10 tests per month 
and could be recognized when testing the same entities. 
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Five of the inspectors interviewed believe TSA's testing protocols 
are not realistic for testing KSP compliance. For example: 

■ One inspector indicated the same inspectors tender 
unknown shipper packages to the air carriers monthly. 
After a while, the air carriers may come to recognize the 
inspectors. 

■ Another inspector said that they perform walk-up tests, 
even though the entities do not accept walk-up business. 

■ An inspector reported that indirect air carriers have their 
own client base and would most likely pass a test since they 
would direct the tester to use another carrier, such as 
FedEx. 

Some inspectors may not be convincing as covert shippers because 
they fear retribution from the entities tested. The protocols require 
inspectors to identify themselves to aircraft operators or indirect air 
carriers that accept the test packages. The inspector's test could 
result in an employee either being removed from a job or the 
entity's operating privilege being revoked if someone incorrectly 
accepts the test package. Some inspectors expressed discomfort 
with using their own identification and would rather use false 
credentials in carrying out these duties because of potential 
retribution. 

In August 2008, TSA's Office of Security Operations engaged the 
field inspectors in a working session to solicit ideas for developing 
future special emphasis assessment tests. Inspectors provided 
more than 75 suggestions, which the agency will use when 
developing tests for fiscal year 2009. 

TSA's Office of Inspection has been planning to conduct red team 
covert testing of air cargo security since 2006. The agency has not 
performed these tests because it does not have the necessary 
undercover authority. TSA's Office of Chief Counsel created a 
legislative proposal in 2007 to resolve this authority problem, but 
DHS rejected the plan as not viable. TSA did not disclose the 
specific reasons for this rejection. In March 2008, TSA's Chief 
Counsel sent an informal action memo to DHS' Office of General 
Counsel requesting the authority; however, this request was also 
denied. 



Transportation Security Administration's Known Shipper Program 

Page 14 



Unless TSA provides proper guidance and performs effective 
inspections and special emphasis assessment testing, the agency 
cannot ensure that KSP is effectively strengthening air cargo 
security. Also, without specific statutory authority, TSA cannot 
establish the covert operation it needs to perform red team tests. 
As a result, the agency may be missing opportunities to identify 
areas of the KSP that could be improved to decrease vulnerabilities 
and risks to air transportation. 

Recommendations 

We recommend that the Assistant Secretary of the Transportation 
Security Administration: 

Recommendation #1 : Resolve all remaining Known Shipper 
Management System technical problems and policy issues so that 
the agency can target and achieve a specific date for mandating 
regulated entities compliance with the new method. 

Recommendation #2 : Document and share with all Department 
of Homeland Security personnel involved in procurement actions, 
the experience and lessons learned from the contracting and 
development of the Known Shipper Management System for use in 
improving future agency program enhancements. 

Recommendation #3 : Enhance the criteria and guidance used in 
the manual process for making a shipper known to provide greater 
assurance that shippers are legitimate and pose a minimal threat to 
aviation security. Specifically, the agency should provide better 
direction on the frequency and efforts required to validate the 
existence, performance, and documentation of each known shipper. 

Recommendation #4 : Provide more specific guidance to 
inspectors conducting reviews of Known Shipper Program 
compliance, including the level of review and effort necessary to 
verify known shipper status, the amount of documentation and air 
waybills to examine, and the appropriate balance in the application 
of the four basic inspection methods. 

Recommendation #5 : Revise special emphasis assessment testing 
protocols to reflect more realistic scenarios. Specifically, the 
agency should revise the protocols based on the many suggestions 
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solicited from field inspectors so the testing will be more reliable 
to gauge compliance. 

Recommendation #6 : Continue to work with the Office of 
General Counsel to obtain undercover authority that would allow 
the agency to perform red team covert testing of Known Shipper 
Program compliance and air cargo security. 

Management Comments and OIG Analysis 

TSA generally concurred with the recommendations in the report. The 
agency will use the findings and recommendations to continue to improve 
the KSP. 

TSA's response indicated that the KSP is an important layer in securing 
the air cargo supply chain, but is by no means the only mechanism used to 
strengthen air cargo security. Rather, the KSP provides one measure of 
security by establishing a valid business relationship between shippers and 
regulated entities that accept cargo for transport by air. Other critical 
layers of TSA's Air Cargo Security Strategy include security threat 
assessments, cargo screening and compliance inspections. 

TSA also noted that the agency has recently made improvements to its Air 
Cargo Security Enforcement Program. For example, TSA's Fiscal Year 
2008 Regulatory Activities Plan directed Transportation Security 
Inspectors to conduct at least two critical inspections per year at air 
carriers and indirect air carriers to determine whether an entity is in 
compliance with known shipper requirements. At least once a month at 
various locations, TSA conducts Cargo Strikes, which are week-long 
regulatory compliance "blitzes" of a target airport's regulated air cargo 
community. In fiscal year 2008, TSA conducted nearly 4,000 covert tests 
of both foreign and domestic air carriers and indirect air carriers in regard 
to known shipper security requirements. 

Management Comments to Recommendation 1: 

TSA Concurs. TSA has aggressively proceeded with several 
modifications to KSMS to correct issues which kept the system from 
operating at a level which could support mandatory use. These 
modifications were developed by TSA and are in the final stages of 



Transportation Security Administration's Known Shipper Program 

Page 16 



testing. Once in production, an evaluation period will be necessary to 
validate the performance and quality standards prior to issuing a 
mandatory requirement. TSA intends to make KSMS mandatory when all 
technical problems and policy issues are fully resolved. 

OIG Analysis: We recognize TSA's efforts to correct the KSMS 
deficiencies by making modifications to the automated system which 
could support mandatory use. This recommendation is resolved but will 
remain open until TSA requires mandatory use of KSMS. 

Management Comments to Recommendation 2: 

TSA concurs, in part . TSA concurs that the agency will benefit from a 
structured review of the program management challenges presented by 
KSMS and from the identification of lessons learned. TSA does not agree 
that sharing lessons learned across the Department would be beneficial. 
Many of TSA's challenges with the program can be attributed to the fact 
that KSDB was deemed to be a short-term fix that was not meant to last 
more than 6 months. However, because of more pressing agency 
priorities, KSDB lasted 5 years. 

OIG Analysis: TSA's response acknowledges that the agency could have 
prevented or alleviated some of the technical problems through better 
management and oversight of the KSMS project and the system's 
developer. TSA also indicated that KSMS performance suffered from the 
contractor's lack of expertise in building systems designed to perform 
KSMS functions, as well as insufficient contractor personnel to support 
the project. We believe these experiences would be a valuable lesson for 
other DHS personnel involved in procurement actions. Accordingly, this 
recommendation is unresolved and will remain open. 

Management Comments to Recommendation 3 

TSA Concurs, in part . TSA's response did not clearly identify why the 
agency partially concurred. TSA is currently revising the known shipper 
portions of the standard security programs to provide more specific details 
to the regulated parties regarding the criteria to make a shipper known 
using the manual approach. The standard security programs were 
scheduled for publication in December 2008. TSA noted that some 
regulated parties have chosen not to fully comply with procedures outlined 
in the standard security programs for making a shipper known through the 
manual method. As such, TSA will continue to aggressively pursue 
enforcement action against these parties when violations are discovered. 
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OIG Analysis: The issuance of the revised standard security programs 
should provide greater assurance that shippers are legitimate. This 
recommendation is resolved but will remain open until we have the 
opportunity to review the security programs. 

Management Comments to Recommendation 4 

TSA Concurs . TSA has already started several different initiatives that 
effectively provide Transportation Security Inspectors more specific 
guidance for conducting reviews of KSP compliance. Some examples 
include an enhanced training curriculum, revising the National Inspection 
Manual, and more in-depth reviews of the regulated entities involving 
known shipper requirements. 

Because of the large number of business models in use, the regulated 
entities must have flexibility to prove compliance with KSP requirements. 
Transportation Security Inspectors must have flexibility to use different 
methods of inspection to determine compliance with these requirements. 
Rather than prescribe exactly how many documents to review or how 
many personnel to interview, TSA ensures Transportation Security 
Inspectors have flexibility by training them in inspection and investigation 
techniques and then empowering them to use inspector discretion to 
determine compliance. 

OIG Analysis: The enhanced training, guidance, and more 
comprehensive inspections should provide better testing of the known 
shipper requirements. This recommendation is resolved but will remain 
open until we have the opportunity to review the enhanced inspector 
training curriculum and National Inspection Manual revisions. 

Management Comments to Recommendation 5 

TSA Concurs . TSA has begun revising its special emphasis assessment 
testing protocols. The agency is modifying the special emphasis 
assessment testing protocols, based on nearly 100 unique suggestions from 
field Transportation Security Inspectors who attended a National 
Transportation Security Inspector Cargo Conference in August 2008. 
TSA expects to implement the new protocols in the second quarter of 
fiscal year 2009. 

OIG Analysis: This recommendation is resolved but will remain open 
until we have the opportunity to review documentation supporting that the 
new special emphases testing protocols have been implemented. 
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TSA Concurs . TSA's Office of Chief Counsel has submitted to DHS 
Office of General Counsel a revised legislative proposal and is working 
with the OGC to complete an Administration review. 

OIG Analysis: This recommendation is closed. 



Transportation Security Administration's Known Shipper Program 

Page 19 



Appendix A 

Purpose, Scope, and Methodology 



The objective of our audit was to determine whether TSA's 
policies and procedures for the Known Shipper Program provide 
assurances that cargo is secure for transport on passenger aircraft. 
We also determined whether TSA's inspections of regulated 
entities provide assurances that those entities are complying with 
KSP requirements. 

We obtained and reviewed applicable federal laws and regulations, 
TSA's standard security programs, security alerts, cargo 
information bulletins, the National Inspection Manual, the Air 
Cargo Strategic Plan, and other related documents. 

We interviewed TSA personnel from the Offices of Transportation 
Sector Network Management, Security Operations, Inspections, 
and Chief Counsel. We also interviewed representatives from 
TSA's Information Technology Division, Solution Delivery 
Branch, and contractors responsible for the development and 
support of the KSMS. 

We visited and interviewed inspectors at three Category X airports. 
At two of the three, we observed TSA personnel performing 
inspections at aircraft operators, all-cargo operators, and indirect 
air carrier facilities. 

We also conducted a review and analysis of ten of the 1 8 Category 
X airports that transported the most freight during fiscal year 2007. 
They were: 

• John F. Kennedy International; 

• Los Angeles International; 

• Chicago O'Hare International; 

• Hartsfield- Jackson Atlanta International; 

• Miami International; 

• San Francisco International; 

• Washington-Dulles International; 

• Honolulu International; 

• Newark-Liberty International Airport; and 

• Dallas/Fort Worth International. 

We obtained summary TSA reports documenting the total number 
and type of inspections each airport performed on the known 
shipper requirements completed at each location between October 
1, 2006, and March 31, 2008. We also obtained several reports 
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summarizing the numbers and types of violations inspectors 
disclosed during their inspections. We judgmentally selected and 
analyzed 381 inspection reports to determine the quality of TSA's 
inspection efforts. We developed a questionnaire and interviewed 
22 TSA inspectors at these airports. 

We conducted this performance audit according to generally 
accepted government auditing standards. Those standards require 
that we plan and perform the audit to obtain sufficient, appropriate 
evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe the 
evidence obtained provides a reasonable basis for our findings and 
conclusions based on our audit objectives. We conducted 
fieldwork between April 2008 and August 2008 under the 
authority of the Inspector General Act of 1978, as amended. 
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INFORMATION 

MEMORANDUM FOR: Richard L, Skinner 
Inspector General 

U.S. Etepflrtmem of Homeland Security (DHS) 

FROM: KipHawteytff 

Assistant Secrety^ 

SUBJECT: Transportation Security Administration (TSA) Response to 

(he DHB Office of (is Inspector General's Draft Repair.: 
Jtansportalior) Security Asimininraiian's Kmwn Sftsppo 
Program, October 20Mi 

Pur pose 

Tllis memorandnrr. constitutes I SA's response to the DHS Office vi [nHpeam OeneraL's 
(OlG) Draft Report, nTflniporJartsH il'ccurifv^tfininir/njjftin'jf Anavw Shipper Program. 
J'SA appreciates OKrs effort in tiids audit Hid will lj* flat? iioslinss mtX recoiriinriidfiricms 
to continue to improve the Known Shipper Program (K^i! > ). 

OlG conducted its review boLween Janitary and October 2008. The ?nidi( f:bje<vtft'es were 
to determine: whether the policies and procedures of the KSP provule assurances that 
cargp is secure for transport on passenger aircraft, and that TSA*s compliant* inspections 
provide assurances that KS^ pc-Jicips find procedures are ioilowcxl, 

OtG ftnjjud tha: while TSA hat made progress impiovinE some aspects <i|11k ftSJF, tht 
agenty 's criicriij and gnidarvw: for Evaluating whether a shipper meets Known Shipper 
rcquinanents are unclear and subject to interpn;uitjftn, and inspection activities do net 
provide assurances Uiat regulated wititiw arc gnmiplying withtlie K5F l s vetting 
tor Liirczn cuts. 

Discussion 

TSA appnK'.atcs OfG^ wdA in hfi ev^liMiirtfi of the KSP, <jt*e of many layers prfneaina 
ths transportation of air cargo on passenger aircraft. As discussed below, 1he nassen^tr 
air car£f> nerwork is protected hy a multi-Jayered security system actively deploying a_i 

WnSNa Jti . T H UTVtfL l MEK l CH H TATM S HiJO I TrVB ftTjCL 'I L l 'W I NrfftHATHVm [AT H MNTMai^U H it 
MWWHjWHfr ftMfrWHI MA I LT 1 SB Mo I' AJrt [irY ll H i DOCUn j ft l T M^ .V B E Ur ii TMfiE& W LTl t OUTT Hii WffW 

i | r , n i .[ |p fflujr < ov T i n.L i nnr:n tinonrr A nvni 1 t|l «n! «hte*tlo n ron Mcun i LTV, MffiBiiiiH, Dc:r«i . 
wwtfewwggB rLCLC.iijtiMAV nauLf m urn ruon/ir on » thk h rnrmw: r a t . uj. Qovcu i -icrr 
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advanced surKeiiiny system. Also. TSA's aif cargfl snc urity inspection program hat 
imjiceinemed nur'or enhancements to air cargo security. 



The Known Skipper Pt-ttgram ir One of Multiply Security Layers for Air Cargo 

A known shipper is a person or company that can demonsJratj; an established bjeinuss 
relationship with a freight forwarder. Thie relationship is verified through items such as 
customer records, shipping contracts, and a. business history. Tlt=X$Pi£ an iirpor^nt 
Layer in SKnring the ait tcigi> supply chain but is by no means the only mKhaiivsui umJ 
'p strengthen air cargo security. Rather, the KSP provides one measure of security fcv 
establishing a vaJid business relationship between shippers and regulated entities that 
accept vsrffl for air transporL 

(Jthrr critical Vaycf? of TSA's Air Car^o Scsurily Slratcgy includ;: 

I ) Vetiint to ensure lhat entitiea and peouls meet securil v standards . Vetting 
includes requiring unycuK with ecmjs to air cargo to undergo v. security tlireat 
asusssmeut and eiKwrinu lhat a prc-spectrvc indirect air carrier- (1AC) is a 
regitiraatc business before granting them an IAC certificate. 

t) Screening ca?go unltm mpproved flcrccnmg methods and technologies. 
Currently, air carriers lire required to setterl * certain percentage of air cargo on 
ptsseitgcr aircraft for explosives, using screening methods such as physical search, 
X-my, mid Explosive* Trace Detection. T5A conducts ICO percent scLccnr;i£ for 
wituiu cuteaorics (i. r tfHrEO deemed tabe liiph risk Mrt dfatiinarl frm^.'isnTisr rT 
aircraft 




_ | Air cargo destined for ehJL- 

cargo srircraft is. screened by carriers for sttw*vmys. 

A^ important tayiet of TS A f s seiseniug regime is i li canine screening fire*. ISA 
catnenny suppnit* shout 463 local law enforcement led canine tcunss. at 75 
domestic airports. These teams spend approximately percent of their time in 
the cargo environment. Furthermore, ISA is deploying S5.TSA-led (earns 
focused solely on screwing aircai^ md Mediated facilities at high-volume 
airports within the United States. Begimirtg irt 2tX>5, I SA incrcswcH funding for 
esmiiic screaiLin; usin^ monies, previously tagged for the development of the 
Ktiovm Shipper Management System (KSMS), which enabled ISA Lo alfecatc 
nors resources to tannic which are directly engaged in the screening af air cargo. 
Alloonlini additional rcao'jnjcs Lo this layer of security: has provided To A with 
belter flexibility in mitigating risk and targeting ever-changing threais. 

T5A £!sc- n?f entfy initiated sever ai new screening programs tn increase Ihe current 
level of air cargo security. 



J UJJU I i rnjj. T l as r . l)r' , i h| H | TCQIHTAJ M & t Jl u mriYli 5ftlUil I TV I t rrOHJ i IAiT I C? . T l I AT M Cn ! I TflC LLED LUDDH THE 
i-w,.,iaivj>;. ur Hv l rF L r Mmjaj. l -nj r AHttjrHll l j LJjCijmErrT m'A" S?. S P. 1 . 1 U SI- LJ W I V I BUT TI I L WMTTBf 

t l S*MTnJUtJ_LJ HUU!A!ILHA ¥ I U5U].T IN en -l L P BHft l "rt (1R ff fl ACT TON. M>lt.L > .a.OOVii l lSMJj.VT 

. v- i j < Lirji. ntm i . i i 1 AVA i LABruTvro u LHJirrBMin i ira unpen j u. a .r 1 . jjl 
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SEN S ITIVE B ECLTUTY [NFQKMATJON 3 

• Tiie Narrow -body Screening A rttendmtnt, By nMjumii g 1 00 percent 
screening cf taTga tr^iispCTted on «!1 narrow- bodied passenger aircraft, 
TS A bm drastically increased air curr^ security by protecting the vast 
majority of passengers on passer g£r aincraAt. This requirement wat 
implemenled by a regulatory prc£TW. Sonendnicnt whicfc tuuk effect in 
October 2008. 

• The Certified Cargo Screening Pn^raia (CC&P). The CCSP is a new 
initiative io assist the air cargo industry' in meeting the mandates of lhc 
Firipletnii!itir,g Rvcotnmettdaiionif <?j rte 9/1 1 Commission Act <A2Q07 
(Wil ArA) which requires 50 and 1 Ofi percent seieenijifi for target brins 
flu wn on passen ger aircrnft "by February 2009 and August 2010, 
rc&podtively Once finly enacted, CCSP will ea» the tmrdftn on air 
carriers by expanding flie industry's screening capacity, allowing security 
minded companies snch os manafactiiring facilities, thinl party 
logistic companies, nnd shippers jo share with air carriers ihe regulatory 

Screening. feUiHfclL 

• £6 e Indirect Air Carrier Scweiiltig Technology Pilot TSA has 
implemented a screening [cchnology pilot with certain higli-^tilurne I AC.;?, 
participating in the CCS-- The pilot creates screening c-apacity at high 
vtiluriK lAte, measure* (he f Uectivcncas of sclccl screening IccKthi logics 
rtfi various coinmodiry classes, and evaluates chain of-cj&lady procedure!; 
for screened cargo as it mo^ei from the 1A<J to the air o-arricr. 

3) Assesamcuts of regulated entities' mim-p li wice wi:Vi security r&a uirwjuants, 
TSA alscujmpioya over 4o0 air caifjo inspectors to enaure that TAQs, air carriers 
Bind ihftir authorised representatives ore in compliance with ISA air wrfpo security 
regulations. 

JY-i has Implemented SigniJic<iAt Zrtipravemertts to ill Air Qirgji Hscurity ti/ifbrcemmt 
Program 

In its draft report, OIG accurately assesses many of the KSP's challenges, It rau&t be 
noted, however, fhar the rspsit dfles flirt t\j TEy reflect rcc-ent imprnVeirienU Tttsule to she 
program. For example: 

■ TSA aperatt) a robust inspection and compliance program to ensure the integrity 
mil security of the KSP, 'ISA's FVOB Regutatary Activities Plan (RAP) directed 
Transportation Security Inspectors (Tils) to conduct at least two critical 
inspections, per year al air carriers and IACe to determine their flftmpliflnct; with 
known shipper rea_uiremnitfr. It is worth noting lhal the National Inspection 
Manual (NTM) identifies a knuwn shipper flotation as one !hat merits the 
rnaxirnura civil penal ty_ 

MB fJ i lLlUMLN I tWJUl iENE I TlVli iS rlC t jmri' ;*. 1H ) i m* Tt O NT] IA T lS ilflHra OLLE& UNE B ItTW E 

fR^'.i i ons or a * cm tAKT i s ap. we i" AftT or Ttnti racu M n i r May dl mj.mm^i w fh i ^j i n -i l ^Rrrm M 

r i ,HM |li Mt N fJfTJ i r U N LJLCt Mi; i ajTAB¥0? TmW B JO B lTAT I &W WH 5KUWTY. W i» .STin i r . Tf) H , n( m! >\ . 
tTmrrmCiUZED REL DA5E MAY I tCSL; L.TIN aviL riiHALTY W WfftHt *t aW* 8 ! miU l .Si QQVER> I^Ei';T 
.■i gilUClllB, H^iiUlC AVMLAP l Ut V ro B- BE TE MtWEB UMPIBiL'B'fi.S l ia, 
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■ ISA conducts Cargo Strikes, vhicli are w«k~teug regulatory compliance 
"rjliTZfiR." of a target airport's regulated air cat^o commimjty, The^e concentrated 
CVChVb enhance TSA's ability to assess whether regulaini entities in, a given 
community arc adhering To known shipper Hnd other cargo security requireaietilt. 
Cargo Strikes use TSls torn target wld oilier airports to pratmne nation-wide 
consistency and are conducted al least once per month at various Locations. 

» TSIs arc required tD lest foridfifl and domestic stir caurucra and JACs for 

compliance with ItflOwp shipper security requireQicnta! During these testa, a TSA 
cmp)o/M wiJI covertly jwse m an unhewn thipps in sin attempt to ship apiece 
of cargo aa a passenger aircraft. In FYOS, TSA required 2,400 covert tests at 
airports across Hie Nation. TSls ea eroded this, requirement by conducting nearly 
4,000 tcsii. Associated enforcement actions have been laken ^'ith rcsjie.s*.TO "hewe 
Icel?, 

■ Since 2001, TSA has revoked the TSA stttnily program approval of 14 IACs , 
preventing these businesses from shipping caig^ On pussier aircraft, 
Revocation constitutes The most -serious enforcement action TSA cm take. The 
vast majority of these (evocations (10) item directly from itivertiptiQiis into 
violalia-is of [he known shipper requirements, One h\C was indicted:, and its 
principal owner served a prison sentence for criminal activities involving 
falsification of known shippeY 



C'flrw lusipn 

I SA spprecialcs OlG's work on this uudit and wil fe&e the recommendations under 
gdviWent. As we have indicated, the KSP cnnsftitoics one of many layer? in trie air 
cargu security system, which is expiring ita fecvis tD ensure that all cargo carried on 
passenger aircraft is screened for explosives in a manner thut does not impede (oinmerce. 

TSA'ffffisjioiusctoOTG'i recommendations is aliachcd. 



in\ur i wftiac[> mJ P-*ac may mj i uu i m r""i..T"^- .'it ^rfi^s aktiO'. roitxr, wlitjim^it 
rtOBUPina, rv' nm: avh. i i atih. i ty to it: BLTiiTtMtK^D u; < i?ffl i 5 u.nr esh . 
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SENSTiVE SECURITY CNfFCH^ATIWI 



Transportation 5«curlty Administration (ISA) RcspoD«« 
Department of Hamelanil Security (DH&) Office ^Inspector General (OlGl Draft 

Rcportt 

TSA 's Knewn Shipper Program, OetobeT JOOS 

RjcflimngDdatktn 1: Resolve all remainlqg Knowu Shipper Management System 
tedmksl problems and pulley issuta so tint tbe agenty target *nd achieve a 
specific: isle fur mannatini resulted r-nrttJei compliance with tli« pew method. 

TSA Concurs . TSA Vfls proceeded aggxssivcly with several modifications to the 
jiutnmMert system to Wtr&il issues which kept ttoe system from operating at a level v/hicih 
could support mandatory use. TSA developed ^iescncKlifidn(jcnis wluch arc in die final 
5laj5ss af testijifi. Qncc the system is in prodietion, an.e,y.aluati«n period -will be 
necessary to validate (he system's perfbrmant* arid^uah^belbn; TSA issues a 
mandatory requirement. TSA intends [<i make the fiib'wn Shipper Management System 
mandatory when al! technical problem* and pslicy issued we fully resolved. 

Hecammegflatinn 2: Document and stare with all Department of Homeland 
Security personnel involved io procurement: aetioHB, the experience and Jkkow 
learnad from Ifar contracting aad development of the Kftuwn Shipper Management 
System for nse in unprovljig future agtntj program enhsiwetiienfs. 

TSA CuncurB. Ju pari . TSA incurs thai it will benefit from a structured review of the 
program management challenges presented by KSMS and from identifying lessons 
teamed. TSA does riot agree that shurmfc Ictsons learned across the Department would 
be beneficial. Many of TSA' & challenges with ths program can be attributed the fast timt 
tlie Known Shipper Database {KSDB) was deemed to be a short-term fa that was not 
' meant to last more tttan 6 months, However, because- of mere pressing Agejlty priorities.. 
KSDB lasted 5 yea/a, 

HecQmiUtnJation |i Knhance lie criteria And guidance used in (be manual profess 
for makill j a sWpper a no wn tti provide greater assurance that shippers are 
fegltlmak and pose a minimal threat to aviatiuri security. SpeciHc*llv, tbe agcaey 
should provide better direction on lie frequency and ifJorti required to validate the 
cxiEtea.ee, perform* arc. and d»?n mentation of each known shipper, 

TSA Concurs, In pari TSA ift tanently revising the kjiown shipped portiona of the 
aiaiKlard security prOE^ams-ta give rcguklcd parties men; detail regarding the titleriu for 
makir^ a shipper known via the muuial approach. The Standard security pro;?™™ arc 
scheduled ibr publication in Member 2008- Notwithstanding these revision^ it must be 
recognized that some regidated parties have cfcnsen not to Mly aomply wtdi procedures 



■.■ v i " no nni rQn.T.inr'.vrn -.r< i™""-™-'" in ■ |linr '"' l " TI " 1 1 thh-b cchtkjlltjc ij ud i .htj i l 

rr MMT3Si£>ii or rriB ssca rrmv or Tt^ns?tmt ation run. s ecurity, yf, 1 iji vr-, se; : ■ 

: mwumrazro -" .la s l w*y hbbhh h rj^ i L i' rjmt.rvnrLgrnLKHc ™ j an u.B.uuvi;LL« M r? * T 
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SENS S TIVE SECURITY INFORMATION 2 

outlined m ibe standmd security pro-ams for making a shipper blown vi* die manual 
method. ISA mid will continue to aggressively purate enforcement action again st 
these parlies wh^i violatinns are discovered, 

RfceammEDdattou At Provide more specific pitnac* to inspectors condudirig 
reviews af Knfrwn £ hlpper Program eumpHinK, indudinjj tie levtl &f rt viaw an d 
effort necessary to verity known shipper status, the amount of dotumcnlDiDQ and 
air waybills tu Hutmin*, ami the approprlnte baJmue Id the application rlie roar 
basic inspection, methods. 

TSACnamrS , Because of ttic Isigs number of business nodcls in line, the regulated 
entities must hav^ flexibility to prove compliance with Known Shipper Program {K5P) 
rcquinmertK Trannportatjoii S«raty Irspsctors (TSIs) must have flexibility lo use 
different methods of tnspecttor., includes StwsiUance, Interview, ^oc-umeril Review. 
sni Tsstini (SIDpT), to detcrmiMB compliwce with Owe* requirements. RaliiLT than 
prescribe exactly how many d^umerflS 10 ttview or how many pcreMT.e! fa interview, 
TSA ensi^s T$Ia have flexibility by training Uiem m i rispectLori arid mvestlgHiiflri 
techniques and then empowering thyii to use discretion! \i> determine sompljantts. 

Nonetheless IS Abas started several inUintwu flut jpveTSI* moms Bpeeiiii! guidance for 
reviewing fiSP CDLTipKiHice. Sonic examples include: 

• Recurrent training. In FYUE, TSA instituted recurrent training for TSIs who 
completed the cure class over 3 v*»rs m- training retries the jnspi>eti<m 
and investigation skills af this workforce and &vt* them 'ipdsted information,- 

» fcabsfteed training. TSA is enhancing Hie core 1*ST training curriculum to tctlw 
instinct new TSIs in the four basic inspection metriods. TSA expects ihs 
improved curriculum to be ready by the cruel of FY 09, 

- Specially trained iustraeHirt. I'SA is using spcniatly uaiticd 731 instoJL-tois wtw 
are upcratiunal field TSU to teach the ctfgo portion* of Che core OaiL This 
ensures ftir TSIft benefit from field krwwledgc and experience. 

• Ftihaaced On tbt Job Training (CUT). TSIs spend two weeks with special y 
trained TSl instructors and shadow them they conduct at! facets of (he 
inspection and investigation process. This erdiEinccrl OJT exposes TSfo lo 
environmeriis other thiui uieir home airpnrt irid focimcs on the SlDaT 
mechudology. 

• Online Training. In October 2(M, TSA established a series of quarterly (raining 
ortlT.c seminars for cargo TSIs. This [raining helps Update and cnka_ice the 
wotk force** Lnspwlitm and investientico skills, 



f£^ b: ; dj i oi run unco ruiri-pry nr te^^^tio^^i.;^! ■ . ^ ~:.^ ^:: -; -r c -^ 
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SENS I T I VE flDCtr.LITY lNTOftMATTOL 3 

* lnspecwr Handlwok. The Nation inspection Manual (NiM) is cunen'-ly under 
iwdawn pnrJ will be reissued as ihe In^aMorHajidbook. A^i slant Federal 
Securilv Directors- Inspection (AfSDs-1) ami field TSIs are dicing the roviEKOS 
to ensure Ums field perspectbe is deluded- Amofi£ other elements, the revised 
handbook will feature best practices dial "mssectoj-s might employ in surea.r£jp 
stsmrty and KMP inspection* The new hwdbnnk is espwtoa trtfce sortipleted in 
FY09. 

M for ctuidiHK (in tho Isvel of review, the FVQS Regulaloi jr Activities Plan (RAFJ 
r«duirtd at least one critic*! iri»pKtion per passenger air earner and indirect earner 
(W;j during a six monrh period , TlicKSris included du^na * critical 3 ^esHKW llic 
FY* RAP requires more in-depth reviews of all related entities, to include w earner 
and lACi ThoBts reviews ire designated "crailpreneHffl ve rt and incl tide Known Stopper 
requi nmcnta Additionally ^ ™Q9 HAP alse requires supplem ental iiuvecoou wtLich 
focus on specific ireftS of reguladnn. 

MoviiiB forward TK A will continue to eipl&re una identify appropriate opportunities Ilk 
addition*! KST guidance- For example, in FY09, T$a will continue ddvelapjug ; w=« 
KUidsuwe- and loting protocols fmascd on high risk areas of air cargo security. 1 Ins 
MtiaovK, along with, an overall expansion of eompliiwee testing, will increase the 
number of tests cantiWX&. 

gMMmmpaaaflaa fl - Revise special emphasis assessment testing protocols to reflect 
nwre realistic «6Cn*rhM. SipecUicaUy. the agency Should teWsc thfl protocols based 
on the many unggestions solicited from flea iiLKpecturs so the 1estin E **1U ft < ' nnre 
reliable to gauge compliance. 

TgA Cwieurs , Ne^ special emphasis assessment (SEA) testing protoco.a, based or. 
nearly 1 DO unique anggcatione from field THJa wnt> attended die recent NaHneral T&I 
Cargo Conference (August 2008), arc expected to implemented iji the second q^rtcr 
ofFY09. 

B^nTnrrundiittoiiS; Continue to work with Ihe Office of General Counsel to obhun 
undercover authority (hit would allow the i^eiiCJ to perform red team covert 
ratine ofKnown Shipper PrOEnfll compliance and air Muipi securUy. 

TSACuncnra . TSA's Office: of Chief Counsel llfls stsfcrnittod to T>HS Office of GcnortU 
Counsel (OGC1 b rev^-w? IcEjislative proposal and h workinj! Willi Hie OGC Lo c^jmr^ele 
A^itiinistralkrn review, 



xciimm, rvniiin whm*ww hm n-rrrj i " i r am f j . -r lit . 
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ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4199, 
fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 



OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 
misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 
Attention: Office of Investigations - Hotline, 
245 Murray Drive, SW, Building 410, 
Washington, DC 20528. 



The OIG seeks to protect the identity of each writer and caller. 



